Regarding the extracted model, we use half of the training data to query the victim model and obtain the labeled dataset. Then the extracted model is trained with Adam [1]} optimizer for 20 epochs with learning rate 5e-5. The average training time is 3 minutes for each epoch.
